Security audit

A security assessment that supports a specific decision

Canada Create provides cyber security audits and risk assessments for Toronto organizations that need to understand their current controls before approving investment, responding to a buyer or planning remediation. The engagement begins with the decision the report must support and the systems that matter to it.

The service is an evidence-based advisory assessment. It is not a SOC 2 examination, ISO certification or a guarantee that an insurer or customer will accept the result. If a requesting organization requires an independent attestation, a prescribed assessor or a specific report format, establish that requirement before commissioning the work. Any existing implementation role or potential conflict should be disclosed at scoping.

Choose the boundary and assessment method

Discovery records the entities, locations, cloud tenants, applications, critical processes and third parties in scope. It also records exclusions, permitted checks, the evidence period and who can authorize access. A focused SaaS production review and a multi-entity insurance-group assessment should not be sold as the same checklist.

Where appropriate, the review can use NIST CSF 2.0 outcomes or another agreed control reference. NIST’s organizational-profile guidance distinguishes current and target cybersecurity outcomes. A mapped assessment helps discuss priorities; it does not confer a NIST certification. Legal and contractual requirements must be identified with the relevant owners rather than inferred from an industry label.

Control areas available for the agreed scope

Identity, endpoints and collaboration

Review account ownership, privileged access, multi-factor authentication, joiner and leaver processes, endpoint coverage, patching, device encryption and relevant email or file-sharing settings. Sampling and evidence limits are documented.

Cloud, networks and applications

Review configuration, exposure, segmentation, logging and change-control evidence for the systems selected. Active exploitation, disruptive scans and production changes require a separately agreed testing or implementation scope.

Data protection and recovery

Examine data handling, backup coverage, recovery responsibilities and existing restore-test records. A configured backup job is not evidence that a business service can be restored within its required time. A new restoration exercise can be proposed separately.

People, suppliers and response readiness

Review supplier access and responsibilities, policy ownership, staff training records, escalation contacts and incident-response documentation. Identify where an external provider’s service description differs from the responsibilities your organization expects it to cover.

What the report needs to make clear

The proposed report separates observed evidence, management statements and items not tested. A missing record is an evidence gap; it should not be silently treated as either proof of failure or proof of effectiveness. Each finding should show the affected asset or process, review method, business consequence and recommended next step. AI can assist evidence organization, analysis and drafting within the agreed information-handling arrangements. Our team reviews its output, applies technical judgement and checks findings against the source evidence. Final deliverables are presented for your review and approval.

• Executive summary: the decision, scope, material findings and limitations.
• Evidence register: source, date, owner, sample and verification status.
• Risk register: likelihood and impact rationale, existing controls, treatment choice and accountable owner.
• Remediation roadmap: priorities, dependencies, expected effort and an agreed review point.
• Handover: unresolved questions, management decisions and any follow-up verification proposed.

Illustrative finding: a leaver-access review lacks a documented system owner. The report would record which evidence was reviewed, which systems were excluded, the possible access risk and who must verify removal. It would not label every account compromised or claim that a policy document proves timely removal.

Audit, risk assessment and penetration testing

A control assessment reviews the selected controls and their evidence. A risk assessment considers plausible consequences and treatment priorities. A penetration test investigates exploitable paths under explicit rules of engagement. These can support one program, but their methods and outputs remain distinct.

Use compliance readiness consulting when the goal is implementation and preparation for an external assurance program. Use security awareness training when staff learning and reporting practices are the specific gap. Remediation or managed security can follow an assessment through a separate agreed scope.

Related guide: choosing a cyber security company.

Prepare for the scoping conversation

Bring the reason for the assessment, any requested framework or questionnaire, a high-level system inventory, relevant provider boundaries and the date the decision is needed. Do not send credentials or sensitive operational evidence through the general enquiry form. Appropriate access and evidence-transfer arrangements are agreed during onboarding.

Custom-scoped engagements; proposal after discovery. The proposal sets the assessment boundary, deliverables, access dependencies and schedule. Implementation, retesting and external attestation are included only when explicitly scoped. The report can inform procurement or insurance discussions; acceptance and commercial terms remain decisions for those third parties.